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args.put (ArgKeys . KEY_KEY_I~ , new 

UNIRShort < (short) InParam. m_KeyID) ) ; 

} 

return args . toByteArray ( > ; 

\ 

catch (Exception e) { } 



10 



return null ; 



15 // Convert OpKeyOut structure to a byte array for the 

UNIRInst ruction 

//****************************************** ****** *••*.**** 

20 public byte [ ] getOpKeyOutAsArray ( ) 

{ 

return m_OpKeysOut . getOpKeyOutAsArray ( ) ; 

} 

25 

//******************************************************************** 

// String representation of this Enhancement 

30 // 

public String toStringO 
{ 

String s = m_GUON + " t" ; 

35 

for (Enumeration EK « getlnl terator ( ) ; EK. hasMoreElements ( ) ; ) 
t 

OpInputParam InParam = (OpInputParam) EK . nextElement () ; 
s += "(" + InParam. m_OpGUON + " : " + 
40 InParam. m OpNum + " : " + InParam. m Keylndex + ■ + InParam. m KeyID+ M ) M ; 

I 

s += ") , [" ; 

45 

for (Enumeration EK2~ = m_Out Fieldsreiements ( ) ; " * 
EK2 . hasMoreElements () ; J 
{ 

String OutFld = (String ) EK2 . nextElement {) ; 
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s +«= " < "+outFld + " 1 "; 



5 

for ( Enumeration EK3 = getOutputGUONKeys ( ) ; 
EK3 . hasMoreElements ( ) ; ) 

i 

Pair GuonKey - ' Pair ) EK3 . next Element { ) , 
10 s += " ("+GuonKey+") " ; 



s += " ] , " + 

15 m_ISMID + " : " + m_Gatherer ID + ":" + m_NodeID 

return s ; 

) 



20 



50 



// to support special operation of slist 



25 //- 



public boolean equals (Obj ect ob j ) 
t 

return ( m_GUON == ( ( EnhanceOpNode ) ob j ) . getGUON ( ) }; 

) 



35 // to support special operation of slist 



public int hashCodeO 

40 t 

//byte vl = (byte) <mj3UOH & OxOOOOOOff) ; 
byte vl = 0 ; 
int v2 = 0 ; 

if ( !m_FieldID. equals ( " M ) ) 
45 v2 = m_FieldID.hashCode ( ) & OxOOOOffff 

return ( vl << 24) + (v2 « 8) + m_OpNum ; 
} 
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5 // 
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CLAIMS 

What is claimed is: 

1 . A system for tracking network session information, the system 
comprising: 

5 an information source module having a source information input and a 

standardized information output, a source information corresponds to 
network usage information, a standardized information corresponds 
to the network usage information transformed into a standard format; 
a first program having at least a first standardized information input and 
1 0 an enhanced data output, a first standardized information input 

corresponding to the standardized information, an enhanced data 
corresponding to the standardized data after at least a partial 
transformation, the at least partial transformation being defined 
according to a data record format; 
1 5 a second program having at least a first enhanced data input and a data 

record output, the first enhanced data corresponding to the enhanced 
data, a data record corresponding to the first enhanced data, the data 
record being formatted according to the data record format; 
a database storing the data record; and 
20 wherein the second program merges duplicate data records that represent 

the same network usage information. 
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2. The system of claim 1 wherein the at least partial transformation 
is defined from a data enhancement procedure, and wherein the data record 
format includes a plurality of fields and wherein the data enhancement 

5 procedure defines how the standardized information is to be transformed into 

the plurality of fields of the data record format. 

3. The system of claim 2 wherein the data enhancement procedure 
includes at least a field enhancement wherein the field enhancement defines a 
source for a predetermined field in the plurality of fields. 

10 4. The system of claim 2 wherein the data enhancement procedure ~~ 

includes at least a field enhancement wherein the field enhancement defines a 
function to be applied to at least a portion of the standardized data. 

5. The system of claim 2 wherein the data enhancement procedure 
defines a plurality of field enhancements, wherein each field enhancement 

15 defines network usage information to be stored in the plurality of fields. 

6. The system of claim 5 wherein at least a first field enhancement 
corresponds to an information source module that performs aggregation on at 
least a portion of the network usage information to be stored in at least a first 
field in the plurality of fields. 

20 7. The system of claim 6 wherein the aggregation occurs by 

aggregating packet flow information, the packet flow information corresponding 
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to a plurality of packets, where each packet in the aggregated packets has the 
same IP source address, destination address and port information. 

8. The system of claim 5 wherein at least a first field enhancement 
corresponds to a set of information source modules that performs filtering and 
aggregation on at least a portion of the network usage information to be stored 
in at least a first field in the plurality of fields. 

9. The system of claim 5 wherein at least a first field enhancement 
corresponds to a set of information source modules that performs merging, 
filtering, and aggregation on at least a portion of the network usage information 
to be stored in at least a first field in the plurality of fields. 

10. The system of claim 5 wherein at least a first field enhancement 
corresponds to a set of information source modules that performs event 
notification and provisioning activation. 

1 1 . The system of claim 2 further comprising a second information 
source module, the second information source module having a second source 
information input and a second standardized information output, a second 
source information corresponds to a second network information, a second 
standardized information corresponds to the second network information 
transformed into a standard format, and wherein the data enhancement 
procedure includes a first definition of at least a first field in the plurality of 
fields being from the standardized information, and at least a second definition 
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of a second field in the plurality of fields being from the second standardized 
information. 

12. The system of 1 1 further comprising a first information source 
and a quality of service information source, and wherein the information source 

5 module receives the network usage information from the first information 

source, and wherein the second information source module receives the second 
network information from the quality of service information source, and 
wherein the first definition defines that a source IP address supplied by the first 
information source should be put into the first field, and wherein the second 
1 0 definition defines a supplied by the DNS server should be put into the second 

field. 

13. The system of claim 1 wherein the second program manages the 
first program and the information source module. 

14. The system of claim 1 wherein the second program causes the 
1 5 data record to be stored in the database. 

1 5. The system of claim 1 wherein the information source module is 
configured to receive the network usage information from a predetermined 
network device. 

16. The system of claim 1 wherein the at least partial transformation 
20 includes policy-based data aggregation which defines how network usage data 

should be aggregated. 
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1 7. The system of claim 1 wherein the network usage information 
includes IP session data. 

18. The system of claim 1 wherein the data format includes a 
plurality of fields including a source IP field, a destination IP field, a source 

5 host field, a destination host field, a service type field, a date and time field, a 

duration field, a total number of bytes field, and a counter field. 

1 9. The system of claim 1 further comprising a customer care and 
billing system coupled to the database, the customer care and billing system for 
accessing the database to generate a bill from the data record. 

1 0 20. A network usage accounting system comprising: 

an information source module coupled to receive network information 

from a network device; 
a gatherer coupled to receive the network information source module, 
the gatherer for performing data enhancements on the network 
1 5 information to create a plurality of data records; 

a central database storing the plurality of data records; and 
a central event manager coupled to receive the plurality of data records, 
the central event manager merging duplicate records in the plurality 
of data records, the duplicate records representing the same network 
20 usage information. 

21. The system of claim 20 wherein the information source module 
is configured to receive network information from a network device chosen 
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from the group of network devices consisting of a proxy server, a domain name 
service server, a firewall, a RADIUS server, and a router. 

22. The system of claim 20 wherein the gatherer performs filtering 
and aggregation on the network information. 
5 23. The system of claim 20 wherein the plurality of data records 

have a predefined data format comprising a plurality of fields, and wherein the 
data enhancements includes at least a first data field enhancement to enhance 
the network information to fill in the first data field. 

24. The system of claim 23 wherein the first data field corresponds 
10 to a source IP address field and wherein the data enhancement includes - 

extracting a source IP address value from the network information. 

25. The system of claim 23 wherein the first data field corresponds 
to a domain name field and wherein the data enhancement includes requesting a 
domain name from a domain name service server. 

15 26. A method of gathering and aggregating network usage 

information from a set of network devices, the system using at least a first 
program and a second program coupled in communications, the method 
comprising: 

accessing network communications usage information; 
20 filtering and aggregating the network communications usage information 

using the first program; 
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completing a plurality of data records from the filtered and aggregated 
network communications usage information, the plurality of data 
records corresponding to network usage by a plurality of users; 
storing the plurality of data records; and 
merging duplicate records in the plurality of data records. 

27. The method of claim 26 wherein completing the plurality of 
records includes accessing user account information. 

28. The method of claim 26 wherein completing the plurality of 
records includes for each data record determining a corresponding source IP 
address, a corresponding domain name, a corresponding type of service used, 
and a corresponding amount of time used. 

29. The method of claim 26 wherein the system includes a third 
program coupled in communications with at least the second program and 
wherein completing the plurality of records includes accessing the third program 
to determine network account information and including the network account 
information in at least a first record in the plurality of records. 

30. The method of claim 26 wherein merging the duplicate records 
includes comparing a plurality of fields in the data records to identify data 
records corresponding to the same network session and merging the 
corresponding records. 

3 1 . The method of claim 26 wherein merging the duplicate records 
includes automatically deleting a duplicate record. 
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32. The method of claim 26 further comprising using the second 
program to automatically update the filtering and aggregation performed by the 
first program. 

33. A network usage tracking system comprising: 

5 means for accessing network communications usage information; 

means for filtering and aggregating the network communications usage 

information using the first program; 
means for completing a plurality of data records from the filtered and 
aggregated network communications usage information, the plurality 
1 0 of data records corresponding to network usage by a plurality of 

users; 

means for storing the plurality of data records; and 

means for merging duplicate records in the plurality of data records. 

34. The network usage tracking system of claim 34 wherein the 
1 5 means for completing the plurality of data records includes one or more 

networked computers running one or more programs. 

35. The network usage tracking system of claim 34 wherein the 
means for storing the plurality of data records includes a relational database. 

36. The network usage tracking system of claim 34 wherein the 
20 means for storing the plurality of data records includes an object database. 

37. A system for accounting for network usage comprising: 
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a plurality of gatherers coupled to receive network usage information, 
each gatherer for performing data enhancements on the network 
information to create a plurality of data records; and 
a central event manager coupled to receive the plurality of data records, 
5 the central event manager merging duplicate records in the plurality 

of data records, the duplicate records representing the same network 
usage information. 
38. The system of claim 37 further comprising a customer care and 
billing application for receiving the plurality of data records and generating 
10 bills. 
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